Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
42,654 results · page 144 of 854
Jun 15, 2026Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.CVE-2026-40766 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.
- Affected
- up to 3.7.25
- What to do
- Affects up to 3.7.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.CVE-2026-40762 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.CVE-2026-40743 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.
- Affected
- up to 3.9.7
- What to do
- Affects up to 3.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Redsys for WooCommerce Light <= 7.0.0 versions.CVE-2026-40741 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Redsys for WooCommerce Light <= 7.0.0 versions.
- Affected
- up to 7.0.0
- What to do
- Affects up to 7.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions.CVE-2026-40732 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions.
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Sales Representative Arbitrary File Deletion in Groundhogg <= 4.4 versions.CVE-2026-40727 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Sales Representative Arbitrary File Deletion in Groundhogg <= 4.4 versions.
- Affected
- up to 4.4
- What to do
- Affects up to 4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.CVE-2026-39594 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.CVE-2026-39591 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.CVE-2026-39587 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.
- Affected
- up to 5.9.0
- What to do
- Affects up to 5.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.CVE-2026-39584 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.
- Affected
- up to 4.1132
- What to do
- Affects up to 4.1132. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.CVE-2026-39583 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.
- Affected
- up to 2.6.62
- What to do
- Affects up to 2.6.62. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.CVE-2026-39579 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.
- Affected
- up to 2.0.31
- What to do
- Affects up to 2.0.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.CVE-2026-39540 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.
- Affected
- up to 1.5.3.2
- What to do
- Affects up to 1.5.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.CVE-2026-39534 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions.CVE-2026-39533 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions.
- Affected
- up to 4.4.4
- What to do
- Affects up to 4.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.CVE-2026-39532 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.
- Affected
- up to 2.3.25
- What to do
- Affects up to 2.3.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.CVE-2026-39530 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.
- Affected
- up to 4.6.5
- What to do
- Affects up to 4.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.CVE-2026-39527 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.CVE-2026-39525 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.
- Affected
- up to 1.16.48.1
- What to do
- Affects up to 1.16.48.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.CVE-2026-39524 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.CVE-2026-39519 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.CVE-2026-39518 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.
- Affected
- up to 4.3.0.0
- What to do
- Affects up to 4.3.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Access Control in Motors < 1.4.107 versions.CVE-2026-39515 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Motors < 1.4.107 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.CVE-2026-39514 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.
- Affected
- up to 2.17.3
- What to do
- Affects up to 2.17.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.CVE-2026-39513 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.
- Affected
- up to 3.12.21
- What to do
- Affects up to 3.12.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.CVE-2026-39512 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.
- Affected
- up to 2.8.152
- What to do
- Affects up to 2.8.152. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.CVE-2026-39511 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.
- Affected
- up to 9.1.08.001
- What to do
- Affects up to 9.1.08.001. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.CVE-2026-39507 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.CVE-2026-39503 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.
- Affected
- up to 3.6.5
- What to do
- Affects up to 3.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.CVE-2026-39502 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.
- Affected
- up to 1.15.38
- What to do
- Affects up to 1.15.38. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.CVE-2026-39499 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.
- Affected
- up to 1.6.19
- What to do
- Affects up to 1.6.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.CVE-2026-39498 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.
- Affected
- up to 4.3.3
- What to do
- Affects up to 4.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.CVE-2026-39493 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.
- Affected
- up to 1.6.9.27
- What to do
- Affects up to 1.6.9.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.CVE-2026-39492 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.
- Affected
- up to 4.9.1
- What to do
- Affects up to 4.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.CVE-2026-39491 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.
- Affected
- up to 4.14.1
- What to do
- Affects up to 4.14.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.CVE-2026-39489 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.
- Affected
- up to 5.1.9
- What to do
- Affects up to 5.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.CVE-2026-39481 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.
- Affected
- up to 2.14.18
- What to do
- Affects up to 2.14.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.CVE-2026-39480 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.CVE-2026-39478 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.
- Affected
- up to 4.23.87
- What to do
- Affects up to 4.23.87. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.CVE-2026-39474 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.
- Affected
- up to 3.0.10
- What to do
- Affects up to 3.0.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.CVE-2026-39472 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.CVE-2026-39471 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.
- Affected
- up to 6.4.3
- What to do
- Affects up to 6.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.CVE-2026-39470 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.CVE-2026-39468 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.
- Affected
- up to 5.11.1
- What to do
- Affects up to 5.11.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.CVE-2026-39465 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.
- Affected
- up to 3.106.0
- What to do
- Affects up to 3.106.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions.CVE-2026-39463 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions.
- Affected
- up to 4.9.31
- What to do
- Affects up to 4.9.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.CVE-2026-39451 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.
- Affected
- up to 18.0
- What to do
- Affects up to 18.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.CVE-2026-39450 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions.CVE-2026-39449 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions.
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions.CVE-2026-39447 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions.
- Affected
- up to 1.6.10.6
- What to do
- Affects up to 1.6.10.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.